---
id: "CVE-2026-120202"
kind: "vulnerability"
aliases: ["CVE-2026-120202"]
title: "Highflame ramparts: security scanner skips nested .pyc files, hiding malicious skill code"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "ramparts", "fixed": [], "affected": ">= 0.8.1, <= 0.8.10", "ecosystem": "crates.io"}]
ecosystems: []
tags: ["ai-agents", "ai-tooling", "cargo", "highflame", "mcp", "python", "ramparts", "rust", "scanner-bypass", "skills"]
not_affected_if: ["no-third-party-skills", "ramparts-not-in-range", "skills-not-scanned-with-ramparts"]
published_at: "2026-10-31T18:17:08+00:00"
first_seen_at: "2026-10-31T18:37:12+00:00"
updated_at: "2026-10-31T18:42:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120202", "first_seen_at": "2026-10-31T18:37:12+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-31T18:42:14+00:00"}]
---

# Highflame ramparts: security scanner skips nested .pyc files, hiding malicious skill code

Highflame ramparts 0.8.1 to 0.8.10 does not look at nested directories or .pyc files when scanning an agentskills.io skill bundle (collect_bundle_siblings and walk_bundle_subdir in src/skills.rs). A skill with clean .py decoys and a malicious unchecked-hash .pyc under scripts/<subdir>/__pycache__/ scans with 0 findings, but CPython loads the .pyc when the skill's code is imported. The reporter's PoC ran os.system at import time on 0.8.2. No fixed release or vendor response found; issue #154 is open.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- crates.io:ramparts affected >= 0.8.1, <= 0.8.10 fixed ?

## How to check

- ramparts is a Rust crate, not a pip package: run `ramparts --version` or `cargo install --list` and look for 0.8.1 through 0.8.10 (0.8.10 is the latest on crates.io).
- Before trusting a ramparts scan of a skill bundle, run `find <bundle> -name '*.pyc' -o -name __pycache__` and treat any hit as suspect; delete them or reject the bundle.

## Fix

No fixed version known. Latest crates.io release is 0.8.10, which is affected. Until a fix ships, remove all __pycache__ directories and .pyc files from skill bundles before installing, and do not rely on ramparts alone to vet untrusted skills.

## Timeline

- 2026-10-31T18:37:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120202
- 2026-10-31T18:42:14+00:00 analyst — VulnCheck CNA advisory + reporter's issue #154 (open, 0 comments, tested on 0.8.2) read; no fix or vendor response found, latest crates.io release is 0.8.10 (still affected). Triage's pip check is wrong: ramparts is a Rust crate (cargo install). CVSS 7.1 (v4, VI:H only, UI:P) understates arbitrary code execution at skill run, but the vector is VulnCheck's; severity left high. Nothing verified: sources are the CNA and a third-party reporter, not the vendor.

## Documents

- [advisory] VulnCheck: Highflame ramparts 0.8.1 through 0.8.10 Skill Bundle Scan Bypass via Nested .pyc https://www.vulncheck.com/advisories/highflame-ramparts-0.8.1-through-0.8.10-skill-bundle-scan-bypass-via-nested-pyc
- [advisory] ramparts #154: .pyc bytecode substitution bypass (open, no fix) https://github.com/highflame-ai/ramparts/issues/154
- [mentions] crates.io: ramparts versions (latest 0.8.10) https://crates.io/crates/ramparts/versions
- [poc] nedlir/skills-scanner-bypass PoC https://github.com/nedlir/skills-scanner-bypass

## From the sources

Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious payloads because collect_bundle_siblings and walk_bundle_subdir skip nested directories and .pyc files. Attackers can distribute a skill bundle with an unchecked-hash .pyc under scripts/<subdir>/__pycache__/ that ramparts silently ignores, while CPython executes it when the skill runs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_